Weaknesses of type CWE-94
4,892 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-66913CRITICALJimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes thEPSS 1.1%CVE-2024-42936CRITICALThe mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modifiEPSS 1.1%CVE-2024-39700CRITICALRemote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub ActionEPSS 1.1%CVE-2024-24525CRITICALAn issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametEPSS 1.1%CVE-2026-25856HIGHOpenBullet2 0.3.2 Authenticated RCE via Job Configuration InterfaceEPSS 1.1%CVE-2024-48581CRITICALFile Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_clEPSS 1.1%CVE-2023-47003CRITICALAn issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlocEPSS 1.1%CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 1.1%CVE-2026-52103CRITICALA zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackeEPSS 1.1%CVE-2024-21541MEDIUMVersions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without EPSS 1.1%CVE-2024-54806CRITICALNetgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commaEPSS 1.1%CVE-2025-26014CRITICALA Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.EPSS 1.1%CVE-2023-38198—acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.EPSS 1.1%CVE-2023-1304HIGHRapid7 InsightCloudSec getattr() method accessEPSS 1.1%CVE-2024-22131CRITICALCode Injection vulnerability in SAP ABA (Application Basis)EPSS 1.1%CVE-2025-45857CRITICALEDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function.EPSS 1.1%CVE-2024-12215HIGHRemote Code Execution in kedro-org/kedroEPSS 1.1%CVE-2021-47736HIGHCMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content EditingEPSS 1.1%CVE-2023-23619CRITICALImproper Control of Generation of Code ('Code Injection') in @asyncapi/modelinaEPSS 1.1%CVE-2020-37186CRITICALChevereto 3.13.4 Core - Remote Code ExecutionEPSS 1.1%